CVE-2021-3750: Use After Free
A DMA reentrancy issue was found in the EHCI controller emulation of QEMU. From https://gitlab.com/qemu-project/qemu/-/issues/541:
""" When EHCI tries to transfer the USB packets, it doesn't check if the Buffer Pointer is overlapped with its MMIO region. So crafted content may be written to the controller's registers and trigger actions like reset, but the device is still transferring packets. """
This flaw could enable a malicious guest to crash QEMU, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. For more information (stack trace, reproducer) see the aforementioned upstream issue.
Other sources
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u12 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
QEMUto a version that resolves this vulnerability.Fixed in 7.0.0
Event History
Frequently Asked Questions
What is CVE-2021-3750?
CVE-2021-3750 is a vulnerability in the USB EHCI controller emulation of QEMU that allows crafted content to be written to the controller's registers and trigger undesirable actions.
What is the severity of CVE-2021-3750?
CVE-2021-3750 has a severity rating of 8.2 out of 10.
How does CVE-2021-3750 affect QEMU?
CVE-2021-3750 affects QEMU's USB EHCI controller emulation.
How can I fix CVE-2021-3750?
To fix CVE-2021-3750, update QEMU to version 7.0.0 or later.
Where can I find more information about CVE-2021-3750?
More information about CVE-2021-3750 can be found at the following references: [link1](https://gitlab.com/qemu-project/qemu/-/issues/541), [link2](https://gitlab.com/qemu-project/qemu/-/issues/556), [link3](https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03692.html).